# HARE virus alert (NOT a joke/hoax)

Ray Bloom (bloom@dsd.camb.inmet.com)
Wed, 21 Aug 1996 16:48:55 PDT

- Messages sorted by:[ date ][ thread ][ subject ][ author ]

    Friends,

    This afternoon, at work, we received the following fax from the FBI
    regarding an imminent computer virus attack (my edits in brackets).
    This is clearly NOT a joke.

    = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

    [From:]	FBI Boston Division
    	Special Agent James Blackburn
    	DECA Coordinator
    	One Center Plaza, Suite 600
    	Boston, MA  02108

    	Voice	617-223-6225
    	Fax	617-223-6327

    To: [Corporate Security Director]

    Message:

    	This edition of DECA-FAX is an alert to corporate security
    directors and others in charge of computer information systems of a
    potentially damaging computer virus known as the "HARE" virus.
    Information about this virus is available on the Internet.  Its
    appearance is scheduled for Thursday, August 22, and again on
    September 22, 1996, and will display the message "HDEuthanasia" on the
    screen.  It is a slow polymorphic, multipartite virus and will damage
    information systems by writing over all the hard disks on the system
    and destroying the data.

    	Several commercial anti-virus software programs have updated
    versions of their product which should help protect against the latest
    batch viruses to include the "HARE" virus.  Systems are always at risk
    for the spread of certain viruses and it is believe that the "HARE"
    virus entered the U.S. via the Internet.  This information is provided
    for those who may need a heightened awareness of potential damage to
    information systems from computer viruses.

    = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

    Our computer and network services department here says that this virus
    hits PCs only (not Macs, not Suns, etc.).  They say that one should
    avoid rebooting one's PC tomorrow (and 22 Sep), and get the
    appropriate anti-virus software.

    Definitions (as best I can):

    	DECA -	"Development of Espionage, Counterintelligence and
    		Counterterrorism Awareness".

    		See http://www.fbi.gov/deca.htm for details.

    	HARE -	Yes, like "Hare Krishna".  Aliases include
    		"HDEuthanasia" and "Krsna".  This virus allegedly is
    		Win95-aware.

    		See http://datafellows.cityhall.com/v-descs/hare.htm
    		for details.  Apparently, one can get a FREE HARE
    		disinfectant utility at
    		http://datafellows.cityhall.com/news/hare.htm.  (This
    		is *not* an endorsement of Data Fellows products, just
    		the result of a web search.)

    	polymorphic - From http://www.umcc.umich.edu/~doug/vb.html:
    		"A POLYMORPHIC virus is one which produces varied
    		(yet fully operational) copies of itself, in the hope
    		that virus scanners ... will not be able to detect
    		all instances of the virus."

    	multipartite - From the same web page: "... a few viruses are
    		able to infect both [files and boot-records].  These
    		are often called 'MULTI-PARTITE' viruses, though there
    		has been criticism of this name; another name is
    		'BOOT-AND-FILE' virus."

    As used to be said on the TV show "Hill Street Blues" ...

    	"Let's be careful out there, people."

    							Ray

    --                                                                    --
    -- Ray Bloom                                     Intermetrics, Inc.   --
    -- Senior Software Engineer                      733 Concord Avenue   --
    -- (Previous Incarnation: IBM Systems Manager)   Cambridge, MA  02138 --
    -- bloom@inmet.com                               (617) 661-1840 x4096 --
    --                                                                    --
    with Standard_Disclaimer;
    use  Standard_Disclaimer;
    function Improve_Message(Text: in Clever_Ideas) return Better_Ideas;
    --                                                                    --
    -- This is an example of software reuse ... 14.4% of this signature   --
    -- was "stolen" from eachus@dr_no.mitre.org.  ;-))                    --